Query: FLS Create issue while running checkmarx

Question

I am running multiple classes and have some Query: FLS Create issues while running the checkmarx. I am really not knowing what they mean by this. I feel there is something simple but I cannot discern it. Below is my explanation:

Below is my class and exact line:

public class ClassM {
public static void methodM(List<Account> acc){
        List<Account> acclst = new List<Account>();
        
        for(Account obj:acc)
        {
            Account newacc = new Account(); //LINE 8
            newacc.Name=obj.Name;
           // newacc.Industry='Education';
           // newacc.AccountSource=obj.AccountSource;
            newacc.BillingCity=obj.BillingCity;
            newacc.BillingCountry=obj.BillingCountry;
            newacc.Rating=obj.Rating;
            acclst.add(newacc); //LINE 14
        }
        insert acclst; //LINE 16
        System.debug('methodM called..');
        ClassN.methodN();
        ClassO.methodO();
    }
}

What are all the checks that I have to do for the lines 8, 14, 16. (I have commented the line number at the end of the line). I shall have to check for field creatable and object creatable i guess. But why is the error also being thrown in the line 14 (when I add account inside the list)?

Answer 1

The Checkmarx tool explains the entire path for a specific error. In other words, there is only one error, and those are all the steps that were taken to explain that conclusion. Working backwards, you have an insert statement that doesn't check if the user can create records. That statement uses data that was added to the list on line 14, containing data created on line 8.

You can fix this easily using the new user mode option introduced in Spring 23.

insert as user acclst;

This will automatically enforce all user permissions for objects and fields, as well as permission sets, etc. Note that you will need to try/catch in case the user doesn't have the appropriate permissions.

You can also use Security.stripInaccessible to make sure the user can only create records with fields they have access to without worrying about field level security, assuming you want to allow a partial save of the data.

Otherwise, you can also manually check security settings for every object and field individually:

if(
  !sObjectType.Account.isCreateable() ||
  !Account.Name.getDescribe().isCreateable() ||
  !Account.BillingCity.getDescribe().isCreateable() ||
  !Account.BillingCountry.getDescribe().isCreateable() ||
  !Account.Rating.getDescribe().isCreateable()
) {
  throw new NoAccessException('You do not have sufficient action to do this.');
}

Obviously this is a lot of extra work, so using the new user-mode feature would help keep your code clean.